Telerik Report Server vulnerabilities
9 known vulnerabilities in Telerik Report Server from Progress Software. 9 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Telerik Report Server: External Control of System or Configuration Setting
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and not
- 8.9 High severity
Telerik Report Server: Improper Neutralization of Input During Web Page Generation
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text
- 7.1 High severity
Telerik Report Server: Incorrect Privilege Assignment
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted serv
- 7.2 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 8.8 High severity
Telerik Report Server: Weak Password Requirements
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
- 8.8 High severity
Telerik Report Server: Improper Restriction of Excessive Authentication Attempts
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
- 9.8 Critical severity
Telerik Report Server: Deserialization of Untrusted Data
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
- 9.8 Critical severity
Progress Telerik Report Server Authentication Bypass by Spoofing Exploited
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
- 8.8 High severity
Telerik Report Server: Deserialization of Untrusted Data
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.